windmill-client 1.821.0 → 1.822.0

package/dist/core/OpenAPI.mjs

@@ -29,7 +29,7 @@ const OpenAPI = {
 	PASSWORD: void 0,
 	TOKEN: getEnv("WM_TOKEN"),
 	USERNAME: void 0,
-	VERSION: "1.821.0",
+	VERSION: "1.822.0",
 	WITH_CREDENTIALS: !getEnv("WM_RAW_APP"),
 	interceptors: {
 		request: new Interceptors(),

package/dist/index.js

@@ -126,7 +126,7 @@ const OpenAPI = {
 	PASSWORD: void 0,
 	TOKEN: getEnv$1("WM_TOKEN"),
 	USERNAME: void 0,
-	VERSION: "1.821.0",
+	VERSION: "1.822.0",
 	WITH_CREDENTIALS: !getEnv$1("WM_RAW_APP"),
 	interceptors: {
 		request: new Interceptors(),

package/dist/types.gen.d.ts

@@ -565,6 +565,10 @@ export type FlowModule = {
      * If true, flow continues even if this step fails
      */
     continue_on_error?: boolean;
+    /**
+     * Scopes the token of this step's jobs is restricted to (domain:action[:resource], e.g. oidc:write), on top of the flow's own restriction: a step can only narrow it. Applies to everything the step runs (loop and branch bodies, AI agent tools).
+     */
+    job_token_scopes?: Array<(string)> | null;
     /**
      * Retry configuration if this step fails
      */
@@ -1030,6 +1034,10 @@ export type AiAgent = {
          * Free-text description of the tool given to the AI to decide when and how to call it. Overrides the description auto-derived from the underlying script.
          */
         description?: string;
+        /**
+         * Scopes the token of this tool's jobs is restricted to, on top of the agent step's own restriction: a tool can only narrow it.
+         */
+        job_token_scopes?: Array<(string)> | null;
         /**
          * The implementation of a tool. Can be a flow module (script/flow) or an MCP tool reference
          */
@@ -2306,6 +2314,10 @@ export type Script = {
         [key: string]: ScriptModule;
     } | null;
     labels?: Array<(string)>;
+    /**
+     * Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job.
+     */
+    job_token_scopes?: Array<(string)> | null;
     /**
      * Labels inherited from the parent folder, computed at read time. Read-only — edit them on the folder.
      *
@@ -2383,6 +2395,10 @@ export type NewScript = {
         [key: string]: ScriptModule;
     } | null;
     labels?: Array<(string)>;
+    /**
+     * Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it.
+     */
+    job_token_scopes?: Array<(string)> | null;
     /**
      * When true (set by the CLI / git sync), deploying this script does not delete an existing user draft at the same path.
      */
@@ -6022,6 +6038,10 @@ export type FlowMetadata = {
      */
     on_behalf_of?: string;
     labels?: Array<(string)>;
+    /**
+     * Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job.
+     */
+    job_token_scopes?: Array<(string)> | null;
     /**
      * Labels inherited from the parent folder, computed at read time. Read-only — edit them on the folder.
      *
@@ -6046,6 +6066,10 @@ export type OpenFlowWPath = OpenFlow & {
      */
     preserve_on_behalf_of?: boolean;
     labels?: Array<(string)>;
+    /**
+     * Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it.
+     */
+    job_token_scopes?: Array<(string)> | null;
 };
 export type EditFlow = OpenFlow & {
     path?: string;
@@ -6065,6 +6089,10 @@ export type EditFlow = OpenFlow & {
      */
     preserve_on_behalf_of?: boolean;
     labels?: Array<(string)>;
+    /**
+     * Scopes the token of every job of this runnable is restricted to (domain:action[:resource], e.g. oidc:write). Jobs it starts, flow steps and AI agent tools inherit the restriction. Unset, the job token carries the full permissions of the identity the job runs as; an empty list leaves it no API access beyond its own job. Omitting the field keeps the deployed value; null clears it.
+     */
+    job_token_scopes?: Array<(string)> | null;
 };
 export type FlowPreview = {
     value: FlowValue;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "windmill-client",
   "description": "Windmill SDK client for browsers and Node.js",
-  "version": "1.821.0",
+  "version": "1.822.0",
   "author": "Ruben Fiszel",
   "license": "Apache 2.0",
   "homepage": "https://github.com/windmill-labs/windmill/tree/main/typescript-client#readme",